An analysis shows that victims of ransomware are paying far less than in previous years. The sum received by perpetrators is on average up to half what is demanded of them.
Chainanalysis comes to some striking conclusions about ransomware in its Crypto Crime report. The total sum that cybercriminals managed to ransom from their victims through ransomware attacks fell by 35 percent. A total of $813.55 million was transferred into the bank accounts of criminal figures. During the “record year” of 2023, the counter reached $1.25 billion.
The declining sums indicate a decreased willingness to pay cybercriminals, Chainanalysis concludes. Only 30 percent of negotiations resulted in a payment, although that decline is not noticeable until the second half of 2024. Many companies are increasingly relying on backups and other recovery methods rather than responding to criminals’ demands. When payment does occur, the sum paid is up to 53 percent lower than what the criminals demand: between $150,000 and $250,000 on average.
read also
Ransomware payments drop by a third by 2024
According to Chainanalysis, tightened enforcement also has an effect. Large groups such as Lockbit have been curbed by international police cations. Tightened regulations around crypto currencies also make it harder for criminal organizations to launder their “earnings.
More attacks, more perpetrators
Not everything is rosy: The number of ransomware attacks is indeed on the rise. More victims appeared on data leak sites, but that could just as easily be repeating old data breaches, according to Chainanalysis. The breakup of large groups is giving way to smaller groups looking to increase their influence, so the number of perpetrators is rising along with the number of attacks.
Sergey Shykevich, Threat Intelligence Lead at Check Point, tempered the hoary mood in a talk at the company’s CPX conference. “As long as victims keep paying, ransomware will not disappear. The willingness to pay or not to pay varies greatly from industry to industry. Criminal actors often operate from countries that do not extradite citizens. This makes it difficult to completely defuse groups even with international police cooperation.”